---
title: Encrypting Passwords for Use in cache.xml
---

<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements.  See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License.  You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<a id="topic_730CC61BA84F421494956E2B98BDE2A1"></a>


Apache Geode provides a gfsh utility to generate encrypted passwords.

You may need to specify an encrypted password in `cache.xml` when configuring JNDI connections to external JDBC data sources. See [Configuring Database Connections Using JNDI](../../developing/transactions/configuring_db_connections_using_JNDI.html#topic_A5E3A67C808D48C08E1F0DC167C5C494) for configuration examples.

The `cache.xml` file accepts passwords in clear text or encrypted text.

To generate an encrypted password, use the [encrypt password](../../tools_modules/gfsh/command-pages/encrypt.html#concept_2B834B0AC8EE44C6A7F85CC66B1D6E18__section_F3D0959AF6264A3CB1821383B2AE4407) command in `gfsh`. The following example shows a sample command invocation and output (assuming `my_password` is the actual password for the data source). After you [start gfsh](../../tools_modules/gfsh/starting_gfsh.html#concept_DB959734350B488BBFF91A120890FE61), enter the following command:

``` pre
gfsh>encrypt password --password=my_password
AB80B8E1EE8BB5701D0366E2BA3C3754
```

Copy the output from the `gfsh` command to the `cache.xml` file as the value of the password attribute of the `jndi-binding` tag embedded in `encrypted()`, just like a method parameter. Enter it as encrypted, in this format:

``` pre
password="encrypted(83f0069202c571faf1ae6c42b4ad46030e4e31c17409e19a)"
```

To use a non-encrypted (clear text) password, put the actual password as the value of the password attribute of the `jndi-binding` tag, like this:

``` pre
password="password"
```


